DSCourier TLS Cert Import into Trusted Root Store via Import-Certificate
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
Microsoft Sentinel (KQL)
